Protection circuit for an access-arbitrated bus system network

ABSTRACT

The invention relates to a protection circuit ( 12 ) for an access-arbitrated bus system network, comprising a fault detection device for detecting a fault status in a sub-network of the overall bus system network; and a separating device for separating the sub-network from the overall network when a fault status is detected in said sub-network.

The invention relates to a protective circuit for an access arbitratedbus system network for isolating a faulty network section from theoverall network.

A bus comprises a plurality of parallel lines for data transmissionwhich connect various functional units in a multiplex mode. On a bus, aplurality of functional units can receive data simultaneously, but onlyone functional unit can serve as a sender of information data at anyparticular time. An access arbitrated bus system is a bus system inwhich a plurality of users have transmission authority for transmissionto the bus, the current transmission authorization being defined by thebus access. Examples of access arbitrated bus systems are CAN bussystems (CAN: Controller Area Network), J 1850 bus systems or bussystems operating on the basis of the CSMA method. The CSMA method(CSMA: Carrier Sense Multiple Access) is an access method for accesswith equal authorization to a plurality of stations or control nodesconnected to the bus.

The CAN bus system is a bus system network, covering an area, forconnecting locally disposed control nodes which is increasingly beingused in vehicles, in particular. The individual control nodes areconnected to one another via the CAN bus system and can interchange dataframes via the bus lines. In this context, the data frames have afunctional identification which identifies the vehicle functionaddressed, such as oil, brake, light or the like. One option for faultmonitoring is to ascertain a particular CAN control node which isprovided for controlling a particular vehicle control function andmonitors the bus lines to determine whether an associated data frame isavailable for this function. If the CAN control node does not receivethe required information within a particular time period, an emergencymode is activated.

FIG. 1 shows a CAN bus system based on the prior art. As per the exampleshown in FIG. 1, the CAN bus system comprises three CAN control nodesCAN1, CAN2, CAN3 which are connected by means of connecting lines a1,b1, a2, b2, a3, b3 to a first CAN bus line having a low level CANL andto a second CAN bus line having a high level CANH. The voltage leveldifference between the high level bus line CANH and the low level busline CANL reproduces the transmitted information. As soon as the leveldifference exceeds a particular voltage threshold value, this isinterpreted as a logic high bit, and as soon as the voltage leveldifference falls below a threshold value, this is interpreted as a logiclow bit.

Various fault states can arise in the CAN bus system, namely a shortcircuit between the two CAN bus lines, a short circuit between one ofthe two bus lines CANL or CANH and ground, and a short circuit betweenone of the two bus lines CANL, CANH and a supply voltage V_(BB). If theCAN bus system based on the prior art, as shown in FIG. 1, is installedin a motor vehicle, the various fault states can be caused by anaccident. If, by way of example, the control node CAN1 is a control nodefor a distance radar situated in the vehicle's bumper, an accidentinvolving a collision may result in a short circuit between the twoconnecting lines a1, b1. This fault state is recognized by all thecontrol nodes in the bus system, which prevents further data interchangevia the bus.

It is therefore the object of the present invention to provide aprotective circuit for an access arbitrated bus system network whichprevents failure of the overall bus system network in the event of ashort circuit occurring on a bus line.

The invention achieves this object by means of a protective circuithaving the features specified in patent claim 1.

The invention provides a protective circuit for an access arbitrated bussystem network having:

-   a fault recognition device for recognizing a fault state in a    network section in the overall bus system network and having-   an isolation device for isolating the network section from the    overall bus system network when a fault state is recognized in the    network section.

Preferred developments of the inventive protective circuit are specifiedin the subordinate subclaims.

In one preferred development of the inventive protective circuit, thefault recognition device monitors voltage levels on the bus lines in thebus system network in order to recognize a fault state.

This affords the particular advantage that the network sectionrecognized as being faulty is isolated with a very short reaction time,since physical voltage levels are monitored directly and no long-lastingtransmission protocol queries are made.

The isolation device is preferably a logic isolation circuit which useslogic to isolate the network section recognized as being faulty from therest of the bus system network.

The logic isolation circuit isolates the network section recognized asbeing faulty from the bus system preferably by blocking the dominanttransmission signal from or to the network section.

In one preferred development of the inventive protective circuit, thelogic isolation circuit is connected to the rest of the control nodes inthe bus system network via a fault bus, the fault bus providing thecontrol nodes with information data indicating that the network sectionrecognized as being faulty is isolated from the overall bus systemnetwork.

In another preferred development of the inventive protective circuit,the fault recognition device has a first fault state detection circuitfor detecting a fault state in a first network section, a second faultstate detection circuit for detecting a physical fault state in a secondnetwork section and a fault recognition logic circuit which is connectedto the two fault state detection circuits and outputs a control signalto the isolation device for the purposes of isolating the two networksections when a fault state is detected by one of the two fault statedetection circuits.

The isolation device is preferably a switching device for switching thebus lines in the bus system network.

In another preferred development of the inventive protective circuit,the fault recognition logic circuit is connected to control nodes in thebus system network via a fault bus, the fault bus providing the controlnodes with information data indicating that the network sectionrecognized as being faulty is isolated from the overall bus systemnetwork.

In another preferred development of the inventive protective circuit,the protective circuit has a first transceiver for connection to a firstnetwork section, a second transceiver for second connection to a secondnetwork section, and a logic isolation circuit, where the transceiverreceiver in the first transceiver is provided for recognizing a faultstate in the first network section, and the transceiver receiver in thesecond transceiver is provided for recognizing a fault state in thesecond network section, and where the logic isolation circuit has logicinputs connected to the transceiver receivers and logic outputsconnected to the transceiver transmitters.

In one preferred embodiment of the inventive protective circuit, thelogic isolation circuit has two reception multiplexers, whose firstinput is respectively connected to a transceiver receiver and whosesecond input respectively has a logically recessive transmission signalapplied to it, and two transmission multiplexers, whose output isrespectively connected to a transceiver transmitter, whose first inputis respectively connected to the output of the reception multiplexer inthe transceiver receiver in the other transceiver and whose second inputrespectively has a logically recessive transmission signal applied toit.

Preferably, the first input of a transmission multiplexer is connectedto the output of a reception multiplexer with DC decoupling.

In one preferred embodiment, the first input of the transmissionmultiplexer and the output of the reception multiplexer are respectivelyDC-decoupled by an interposed optocoupler.

The inventive protective circuit is preferably provided for a CAN bussystem, a J 1850 bus system or a CSMA bus system.

In one preferred development of the inventive protective circuit, thefault recognition device recognizes as fault states short circuitsbetween the lines in a network section, short circuits between the linesin the network section and ground, and short circuits between the linesin a network section and a supply voltage.

In one preferred development of the inventive protective circuit, thefault recognition device recognizes the termination of a fault state ina network section and actuates the isolation device to remove theisolation between the network sections and the overall bus system.

Preferred embodiments of the inventive protective circuit are describedbelow with reference to the appended drawings in order to explainfeatures which are fundamental to the invention.

In the drawings:

FIG. 1 shows a CAN network based on the prior art;

FIG. 2 shows a CAN bus system network with a first embodiment of theinventive protective circuit;

FIG. 3 shows a CAN bus system network with a second embodiment of theinventive protective circuit;

FIG. 4 shows the isolation device for isolating the network sections inthe second embodiment of the inventive protective circuit, shown in FIG.3.

FIG. 2 shows a CAN bus system network with a first embodiment of theinventive protective circuit.

As can be seen in FIG. 2, the CAN bus system network comprises two CANbus lines, namely a high level CAN bus line 1 a, 1 b (CAN-H) and a lowlevel CAN bus line 2 a, 2 b (CAN-L). In the example shown in FIG. 2, theoverall bus system network has three CAN control nodes 3, 4, 5. Each ofthe three control nodes 3, 4, 5 has a respective transceiver 3 a, 4 a, 5a and a microprocessor 3 b, 4 b, 5 b. The transceivers 3 a, 4 a, 5 arespectively comprise a transceiver transmitter and a transceiverreceiver, with the transceiver transmitter being connected to themicroprocessor via a respective transmission line 3 c; 4 c, 5 c, and thetransceiver receiver being connected to the microprocessor via a line 3d, 4 d, 5 d. The CAN bus lines 1 a, 2 a, 1 b, 2 b are connected to thecontrol node 3 via control node connecting lines 6, 7, to the controlnode 4 via connecting lines 8, 9 and to the control node 5 viaconnecting lines 10, 11.

Connected into the CAN bus lines 1 a, 1 b, 2 a, 2 b is an inventiveprotective circuit 12 for the CAN bus system network on the basis of afirst embodiment. The interposition of the protective circuit 12 in theoverall bus system network subdivides said network into two networksections in the example shown in FIG. 2. The first network sectioncomprises the control node 3, the connecting lines 6, 7 for the controlnode 3 and the CAN bus lines 1 a, 2 a, to which bus line connections 13a, 14 a for the inventive protective circuit 12 are connected. Thesecond network section is formed by the two CAN control nodes 4, 5,which are connected to the CAN bus lines 1 b, 2 b via connecting lines8, 9 and 10, 11. The CAN bus lines 1 b, 2 b are connected to CAN busline connections 13 b, 14 b for the inventive protective circuit 12.

In the inventive protective circuit 12 based on the first embodiment,the fault recognition device has a first fault state detection circuit15 for detecting a fault state in the first network section and a secondfault state detection circuit 16 for detecting a fault state in thesecond network section. The outputs of the two fault state detectioncircuits 15, 16 are connected to a fault recognition logic circuit 19via lines 17, 18. When a fault state is detected in one of the twonetwork sections by one of the two fault state detection circuits 15, 16the fault recognition logic circuit 19 outputs a control signal via acontrol switching line 20 to a switching device 21 for the purpose ofswitching internal bus lines 1 c, 2 c within the protective circuit 12,the internal bus lines 1 c, 2 c respectively connecting the bus lineconnections 14 a, 14 b and 13 a, 13 b to one another. The switchingdevice 21 has a plurality of switches 22, 23 connected in parallel, witha respective switch being provided for each bus line 1 c, 2 c. Theswitches 22, 23 are preferably semiconductor switches which block inboth signal directions in the off state. The semiconductor switchespreferably comprise two reverse-connected series MOSFET transistorswhose forward resistance is less than 10 Ω.

The fault state detection circuits 15, 16 detect short circuits betweenthe lines in a network section, for example between the connecting lines6, 7 for the control node 3 in the first network section, as a firstfault state.

In the example shown in FIG. 2, the first network ection can be anetwork section which is arranged in the external region of a vehiclebody. In this case, an accident may result in a short circuit betweenthe connecting lines 6, 7 for the control node 3. This short circuit isdetected by the fault state detection circuit 15 using resistors (notshown) In addition, the two fault state detection circuits 15, 16recognize as a second fault state a short circuit between the bus linesin the two network sections and ground or earth, and a short circuitbetween the bus lines in the two network sections and a supply voltageV_(BB).

The two fault state detection circuits 15, 16 detect a fault state whichhas arisen in one of the two network sections by directly monitoringphysical voltage levels, and not using bus data protocol queries. Thismeans that a fault state which has arisen can be detected very quickly,and the two network sections are isolated from one another by theinventive protective circuit 12 within a very short reaction time ofbelow 10 μs.

The fault recognition logic circuit 19 receives fault recognitionsignals from the two fault state detection circuits 15, 16 via thecontrol lines 17, 18 and performs a logic OR operation. As soon as afault state arises in one of the two network sections, the two switches22, 23 in the switching device 21 are turned off by the faultrecognition logic circuit via the switching control line 20, and the twonetwork sections are isolated from one another.

When the two switches 22, 23 have been turned off and the two networksections have been isolated, the fault recognition device in theinventive protective circuit 12 can recognize in which of the twonetwork sections the fault state has occurred. If the fault statedetection circuit 15 continues to output a fault state detection signalto the fault recognition logic circuit 19 via the line 17 after the twoswitches 22, 23 have turned off, while at the same time the fault statedetection circuit 16 outputs no fault recognition signal to the faultrecognition logic circuit 19 via the fault recognition line 18, then thefault recognition logic circuit 19 recognizes that the fault state hasarisen in the first network section. If, conversely, the fault statedetection circuit 15 reports no fault state after the switches 22, 23have turned off, while at the same time the fault state detectioncircuit 16 continues to report a fault state, the fault recognitionlogic circuit 19 recognizes that the fault has arisen in the secondnetwork section.

The fault recognition logic circuit 19 is preferably connected to themicroprocessors 3 b, 4 b, 5 b in the CAN control nodes 3, 4, 5 via anadditional fault bus line 24. The fault bus line 24 provides the controlnodes 3, 4, 5 in the two network sections with information dataindicating that a network section recognized as being faulty is isolatedfrom the overall bus system network. With a multiplicity of networksections, the control nodes are additionally informed about whichnetwork section has had the fault state arise in it on a local basis.

FIG. 3 shows a second embodiment of the inventive protective circuit 12.In the case of the second embodiment of the inventive protectivecircuit, shown in FIG. 3, the two network sections are not isolatedphysically by splitting the bus line, but rather are isolated usinglogic. The protective circuit 12 based on the second embodiment has afirst transceiver 25 for connection to the bus lines 1 a, 2 a in thefirst network section via the bus line connections 13 a, 14 a, and alsoa second transceiver 26 for connection to the bus lines 1 b, 2 b in thesecond network section via the bus line connections 13 b, 14 b. Thetransceivers 25, 26 each have transceiver transmitter parts 25-S, 26-Sand transceiver receiver parts 25-E, 26-E. The two transceivertransmitter parts 25-S, 26-S are connected to a logic isolation circuit29 via lines 30, 31. The transceiver receiver parts 25-E and 26-E in thetwo transceivers 25, 26 are connected to the logic isolation circuit 29via lines 27, 28.

FIG. 4 shows the circuit design of a preferred embodiment of the logicisolation circuit 29 in the case of the second embodiment of theinventive protective circuit 12, as shown in FIG. 3.

The logic isolation circuit 29 preferably contains four multiplexers,namely two reception multiplexers 32, 33 and two transmissionmultiplexers 34, 35. Each of the multiplexers 32, 33, 34, 35 has tworespective signal inputs, a signal output and a control line connection.The first signal input 36 of the reception multiplexer 32 is connectedto the transceiver receiver part 25-E via the line 27, with a recessivetransmission signal from the access arbitrated bus system network whichis to be protected being applied to the second signal input 37.

A CAN network has two transmission signal states, namely a logic highlevel recessive transmission signal state and a logic low level dominanttransmission signal state. In the quiescent state, the logic high levelrecessive transmission signal state is present on the bus line, whileactive data transmission uses both the low level dominant transmissionsignal state and the high level transmission signal state. In a CAN bussystem, the second signal input 37 of the reception multiplexer 32 thushas a logically recessive high level transmission signal applied to itwhich is indicated by a logic H in FIG. 4.

The first signal input 38 of the second reception multiplexer 33 isconnected to the transceiver receiver part 26-E via the line 28. Thesecond signal input 39 of the second reception multiplexer 33 likewisehas a logically recessive data transmission signal applied to it.

The signal output 40 of the first reception multiplexer 33 is connectedvia a line 41 to the first signal input 42 of the transmissionmultiplexer 35, whose second signal input 43 receives a logicallyrecessive transmission signal. The signal output 44 of the transmissionmultiplexer 35 is connected to the transceiver receiver part 26-S viathe line 31.

The signal output 45 of the reception multiplexer 33 is connected via aline 46 to the first signal input 47 of the transmission multiplexer 34,whose second signal input 48 receives a logically recessive transmissionsignal. The signal output 49 of the transmission multiplexer 34 isconnected to the transceiver transmitter part 25-S via the line 30.

The reception multiplexer 32 is switched via a control line 50 which isconnected to the output line 30 of the transmission multiplexer 34. Thetransmission multiplexer 34, for its part, is controlled via a controlline 51 which receives the signal produced at the output connection 40of the reception multiplexer 32 as control signal.

The reception multiplexer 33 is controlled via a control line 52 whichis connected to the output connection 44 of the transmission multiplexer35. The transmission multiplexer 35 receives its control signal via acontrol line 53 which is connected to the output connection 45 of thereception multiplexer 33.

The reception multiplexer 32 receives a received signal RxD1 from thereceiver 25 via the signal line 27. The reception multiplexer 33receives a received signal RxD2 from the transceiver 26 via the line 28.Conversely, the transmission multiplexer 34 outputs a transmitted signalTxD1 to the transceiver 25 via the line 30, and the transmissionmultiplexer 35 outputs a transmitted signal TxD2 to the transceiver 26via the signal line 31.

The table below shows the transmitted and received signals in the logicisolation circuit 29 for the various operating situations B in the bussystem.

TABLE 1 Operating situation B RxD1 RxD2 TxD1 TxD2 B1 Quiescent state 1 11 1 B2 Transmitter in network section A 0 0 {circle around (1)} 0 B3Transmitter in network section B 0 0 0 {circle around (1)} B4Transmitter in both network 0 0 {circle around (1)} {circle around (1)}sections B5 Fault in network section A 1/0 x {circle around (1)} {circlearound (1)} B6 Fault in network section B x 1/0 {circle around (1)}{circle around (1)}

In this context, {circle around (1)} signifies a high level recessivesignal which is output in order to prevent a deadlock state. A {circlearound (0)} arises as a consequence of the transmission of a dominantbus state.

In operating situation B1, the entire bus system is in the quiescentstate. In operating situation B2, a control node in a first networksection A is transmitting, so that the reception multiplexer 32 receivesvia the line 27 a dominant low level transmitted signal 0 which isforwarded via the line 31 as transmitted signal TxD2.

If, conversely, the second network section B is transmitting, the logicisolation circuit 29 receives a logically dominant 0 signal via thecircuit 28 and forwards it on the line 30 to the first network section Avia the transceiver 25. From the operating situations B4, B5, B6, thetwo network sections A, B are isolated by logic such that no dominantlogic low level data transmission signals are connected by the isolationcircuit 29, but instead a blocking signal is inevitably produced. Inthis case, the signal outputs 44, 49 of the two transmissionmultiplexers 35, 34 are set to the recessive high level datatransmission signal.

The table below shows the transmitted and received signals in a controlnode 3 in the first network section A and a control node 4 in a secondnetwork section B for the various operating situations B.

The control node 3 transmits a transmitted signal S₁ and receives areceived signal E₁. The control node 4 transmits a transmitted signal S₂and receives a received signal E₂.

TABLE 2 Operating situation B S₁ S₂ E₁ E₂ B1 Quiescent state 1 1 1 1 B2Transmitter in network section A 0 1 0 0 B3 Transmitter in networksection B 1 0 0 0 B4 Transmitter in both network 0 0 0 0 sections B5Fault in network section A x 0/1 x S₂ B6 Fault in network section B 0/1x S₁ x

In one preferred development of the logic isolation circuit 29 shown inFIG. 4, the signal input 42 of the transmission multiplexer 35 isconnected to the signal output 40 of the reception multiplexer 32 withDC decoupling. In addition, the first signal input 47 of thetransmission multiplexer 34 and the signal output 45 of the receptionmultiplexer 33 are connected with DC decoupling. In this case, theconnecting lines 41, 46 are preferably DC-decoupled by interposedoptocouplers. The DC isolation of the two network sections by theoptocouplers has the particular advantage that the various networksections can be provided with different supply voltages V_(BB) for thebus lines.

The logic isolation circuit 29 is connected to the control nodes 3, 4, 5via a fault bus line 24 in order to transmit information data.

As can be seen from FIG. 2 and FIG. 3, both embodiments of the inventiveprotective circuit are of symmetrical design, which means that theinventive protective circuit 12 can be used in bus lines 1, 2, with thebus line connection 14 a being able to be interchanged with the bus lineconnection 14 b, and the bus line connection 13 a being able to beinterchanged with the bus line connection 13 b. Preferably, the bus lineconnections 13 a, 14 a and the bus line connections 13 b, 14 b can alsobe interchanged when the protective circuit 12 is inserted into the bussystem network. This affords the particular advantage of simpleassembly.

The inventive protective circuit 12 is distinguished by very low circuitcomplexity, which facilitates its design using standard chips. Theinventive protective circuit can be used universally in all accessarbitrated bus system networks, such as a CAN bus system, a J 1850 bussystem or a CSMA bus system. It can be interposed at any points withinthe bus system network. The direct monitoring of the physical levelstate on the bus lines means that the inventive protective circuit 12 isdistinguished by a very short reaction time of less than 10 μs. Anotheradvantage of the inventive protective circuit is that the faulty networksection can be located, with this also being communicated to bus systemcontrol nodes via a fault bus 24. When the fault state has beenterminated, the inventive protective circuit 12 automatically removesthe isolation of the network sections again.

1. A protective circuit comprising: a first transceiver to connect to afirst network section; a second transceiver to connect to a secondnetwork section; and a logic isolation circuit to isolate a networksection from a bus system network using logic when a fault state isrecognized in the network section, the logic isolation circuitcomprising a reception multiplexer having a first signal input connectedto a first transceiver receiver and a second signal input to receive alogically recessive transmission signal; and a transmission multiplexerhaving a signal output connected to one of the transceiver transmittersand a first signal input connected to a signal output of the receptionmultiplexer for the transceiver receiver, wherein a logically recessivetransmission signal is applied to a second signal input of thetransmission multiplexer; wherein a first transceiver receiver in thefirst transceiver recognizes a fault state in the first network section,and a second transceiver receiver in the second transceiver recognizes afault state in the second network section, and the logic isolationcircuit includes logic signal inputs to connect to both receivers andlogic signal outputs to connect to transceiver transmitters.
 2. Theprotective circuit of claim 1 wherein the logic isolation circuit blocksa dominant transmission signal from the first network section.
 3. Theprotective circuit of claim 1 wherein the logic isolation circuit blocksa dominant transmission signal to the second network section.
 4. Theprotective circuit of claim 1 further comprising a fault bus to connectthe logic isolation circuit to control nodes in the bus system network,wherein the fault bus provides information data to the control nodesindicating that the network section recognized as faulty has beenisolated from the bus system network.
 5. The protective circuit of claim1 wherein the first signal inputs of the transmission multiplexers areconnected to the signal outputs of the reception multiplexers with DCdecoupling.